From 8345512febd09e39c55bdf76ee0fb41b32562f45 Mon Sep 17 00:00:00 2001 From: Boris Ostrovsky Date: Wed, 6 Jan 2016 15:03:21 -0500 Subject: [PATCH] libxc: Don't write terminating NULL character to command string When copying boot command string for HVMlite guests we explicitly write '\0' at MAX_GUEST_CMDLINE offset. Unless the string is close to MAX_GUEST_CMDLINE in length this write will end up in the wrong place, beyond the end of the mapped range. We don't need to limit the size of command string to some arbitrary number. Any size that can be successfully allocated and mapped is valid and so the string is guaranteed to be NULL-terminated (since we use strlen, which needs terminating '\0', to calculate allocation size). Signed-off-by: Boris Ostrovsky Acked-by: Wei Liu --- tools/libxc/xc_dom_x86.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tools/libxc/xc_dom_x86.c b/tools/libxc/xc_dom_x86.c index 39608752d0..b8d290464b 100644 --- a/tools/libxc/xc_dom_x86.c +++ b/tools/libxc/xc_dom_x86.c @@ -676,8 +676,7 @@ static int alloc_magic_pages_hvm(struct xc_dom_image *dom) if ( dom->cmdline ) { - strncpy(cmdline, dom->cmdline, MAX_GUEST_CMDLINE); - cmdline[MAX_GUEST_CMDLINE - 1] = '\0'; + strncpy(cmdline, dom->cmdline, cmdline_size); start_info->cmdline_paddr = (seg.pfn << PAGE_SHIFT) + ((uintptr_t)cmdline - (uintptr_t)start_info); } -- 2.39.5